Problem
The limitation via systemd is not effective if only systemd/journald/SystemMaxUse: 500M is set.
Investigation:
UCR Variables related to journalctl logging:
systemd/journald/MaxFileSec: 1 day
systemd/journald/MaxRetentionSec: 12 week
systemd/journald/Storage: persistent
systemd/journald/SystemKeepFree: <empty>
systemd/journald/SystemMaxFileSize: **100M**
systemd/journald/SystemMaxUse: <empty>
Solution:
If SystemMaxFilesize is set (default: ), the journal does not grow beyond the limit defined there:
root@master:/var/log/journal# du -hs *
89M 8e21d93a97164202b2f9016c547d76d9
A change requires a restart of the journalctl service (ucr commit is executed automatically).
systemctl restart systemd-journald
It is still unclear, WHEN journalctl implements this change and reduces the logfile accordingly…